PR #11015 bounds fetch_url_tool to URLs the user typed in the current turn, and enforces the same policy on redirect hops. It does not cover Anthropic's server-side web_search.
WEB_SEARCH_TOOL (backend/utils/retrieval/agentic.py) is attached to the request whenever include_server_web_search=True. Anthropic executes those server_tool_use blocks itself; the backend only observes them at content_block_start to emit a status thought. They never reach _execute_tool, so the current-turn allowlist, the SSRF address guard, and the redirect check do not apply.
Consequence: after a memory, Gmail, or screen tool returns sensitive data, an injected instruction can get that data placed in a web_search query string, which leaves the boundary as an outbound request. The only control today is the prose in AGENT_SAFETY_INSTRUCTIONS.
Reported by Codex review on #11015 (comment 3714902708). Left out of that PR deliberately — it is a product-behaviour change to the search surface, not part of the bounded fetch_url slice.
Options worth evaluating: drop the server tool from loops that have already consumed untrusted tool output, or route search through a function tool that can apply a runtime provenance check.
PR #11015 bounds
fetch_url_toolto URLs the user typed in the current turn, and enforces the same policy on redirect hops. It does not cover Anthropic's server-sideweb_search.WEB_SEARCH_TOOL(backend/utils/retrieval/agentic.py) is attached to the request wheneverinclude_server_web_search=True. Anthropic executes thoseserver_tool_useblocks itself; the backend only observes them atcontent_block_startto emit a status thought. They never reach_execute_tool, so the current-turn allowlist, the SSRF address guard, and the redirect check do not apply.Consequence: after a memory, Gmail, or screen tool returns sensitive data, an injected instruction can get that data placed in a
web_searchquery string, which leaves the boundary as an outbound request. The only control today is the prose inAGENT_SAFETY_INSTRUCTIONS.Reported by Codex review on #11015 (comment 3714902708). Left out of that PR deliberately — it is a product-behaviour change to the search surface, not part of the bounded
fetch_urlslice.Options worth evaluating: drop the server tool from loops that have already consumed untrusted tool output, or route search through a function tool that can apply a runtime provenance check.